vendor:
Online Voting System Project in PHP
by:
Sagar Banwa
8.8
CVSS
HIGH
Persistent Cross-Site Scripting
79
CWE
Product Name: Online Voting System Project in PHP
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Windows 10/Kali Linux
2020
Online Voting System Project in PHP – ‘username’ Persistent Cross-Site Scripting
An attacker can inject malicious JavaScript code into the 'username' field of the Online Voting System Project in PHP. This code will be stored in the database and will be executed when the user logs in to the account. This can be used to steal user credentials or redirect the user to a malicious website.
Mitigation:
Input validation should be used to prevent malicious code from being stored in the database. Additionally, the application should use a Content Security Policy (CSP) to prevent the execution of malicious code.
